1.4 KiB
1.4 KiB
| created | path | project | tags | type | |||
|---|---|---|---|---|---|---|---|
| 2026-05-17 | Sources/Homelab | postgres-consolidation-reflection-layer |
|
session-notes |
Outcome
Final verification of the vault MCP write path after wiring VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns pushed: true, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.
Topics Covered
The full push fix:
- gitea PAT generated for lovebug user with write:repository scope
- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
_ensure_https_remotehelper in git_writer.py rewrites origin URL + configures credential.helper on first push- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config
Key Learnings
The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f); the env var resolves at runtime.
Follow-ons
- If pushed: true: vault MCP write surface complete, the previous pending commit (
5fb0ce2) plus this new one should both be on origin - If pushed: false: surface the actual git push error from vault container logs